How SafePrompt scores on the public attack benchmarks
See how SafePrompt handled attacks and ordinary messages in dated public test sets. Each score names what was measured. Every per-case result is public.
The scoreboard
Across TensorTrust and HackAPrompt, SafePrompt caught 1,100 of 1,200 attack prompts. On the ordinary prompts in four public sets, it passed 999 of 1,038. On AgentDojo, SafePrompt held successful attacks on a tool-using agent to 4 of 949. With no defence, 239 succeeded.
| Benchmark | SafePrompt |
|---|---|
| TensorTrust, hijack attempts caught | 88% |
| HackAPrompt, jailbreaks caught | 92% |
| BIPIA, ordinary documents passed | 97% |
| AgentDojo, attacks that reached their goal | 4 of 949, against 239 with no defence |
| deepset prompt-injections, ordinary prompts passed | 99.7% |
| NotInject, ordinary prompts passed | 92% |
Building an agent? The agent security page shows attack outcomes and finished tasks side by side.
Checks come back in about 748ms, the median across 390,194 production calls in the last 30 days.
What each test set throws at it
SafePrompt was tested against human-written hijack attempts from the TensorTrust game, with the defenders' real access codes as the ordinary messages (200 attack cases and 200 ordinary cases), and scored 88% on hijack attempts caught, 176 of 200.
SafePrompt was tested against human-written jailbreaks that worked in the HackAPrompt competition, 100 from each of its ten levels (1,000 attack cases), and scored 92% on jailbreaks caught, 924 of 1,000.
SafePrompt was tested against Microsoft's indirect-injection set: emails, tables and code the model is asked to read, with an instruction hidden inside (100 attack cases and 100 ordinary cases), and scored 97% on ordinary documents passed, 97 of 100.
SafePrompt was tested against an AI agent (GPT-4o-mini) doing real tasks with tools across four suites (workspace, travel, banking and slack), with attacks planted in the tool output it reads; SafePrompt checks every tool output (949 attack cases). With no defence checking the tool output, 239 attacks reached their goal. With SafePrompt, 4 did.
SafePrompt was tested against deepset's public set of 662 English and German prompts, injections and ordinary questions mixed, scored on the ordinary side (263 attack cases and 399 ordinary cases), and scored 99.7% on ordinary prompts passed, 398 of 399.
SafePrompt was tested against 339 ordinary prompts written to trip over-sensitive filters, each built around a trigger word such as ignore, override or bypass (339 ordinary cases), and scored 92% on ordinary prompts passed, 311 of 339.
Can you reproduce this?
SafePrompt ran every row on one production detector version, Worker 64fb4530: the public sets on 10 October 2026 and AgentDojo on 21 to 22 October 2026. No two rows were scored by different code.
Every score is zero shot: no detector change was aimed at any of these sets.
- TensorTrust: 200 attack cases, 200 ordinary cases.
- HackAPrompt: 1,000 attack cases.
- BIPIA: 100 attack cases, 100 ordinary cases.
- AgentDojo: 949 attack cases.
- deepset prompt-injections: 263 attack cases, 399 ordinary cases.
- NotInject: 339 ordinary cases.
The repo README gives the exact command for each set.
Every per-case result, including the ones SafePrompt got wrong, is published at github.com/ianreboot/safeprompt/tree/main/benchmarks/external.
What SafePrompt covers
SafePrompt screens submitted text for attempts to redirect the AI reading it. Your app enforces the verdict before model consumption and keeps control of permissions and tool actions.
SafePrompt is built by Ian Ho, founder of Reboot, Inc. and formerly a technical architect at eBay.
Start with your email. No card.